Programmable Controller

ABSTRACT

While a microcomputer  100 A is executing a self-diagnosis (A), second diagnosis pulse output means  110 B of a B-system microcomputer  100 B is not used utterly. Further, during this time, the B-system microcomputer  100 B does not execute a processing relating to at least the self-diagnosis (A) utterly. By shifting the timings for the A-system and the B-system to output the diagnosis pulses, independencies can be secured between respective diagnosis processing (self-diagnoses (A) and (B)). Thus, the independencies between the A-system and the B-system can be verified briefly by the self-diagnosis (A) on the A-system side. Further, first diagnosis pulse group are outputted parallel and simultaneously from first diagnosis pulse output means  110 A. Thus, since cyclic control is not required for respective external input devices, it can be done to verify the independencies between the A-system and the B-system within a short period of time.

TECHNOLOGICAL FIELD

The present invention relates to a sequence control for the operationsof a robot, a machine tool and peripheral devices therefor andparticularly, is very useful in highly securing the reliability andsafeness in the processing for input signals inputted to a programmablecontroller (PLC).

BACKGROUND ART

There is a system wherein a programmable controller performs thesequence control like that aforementioned above. In recent years, thereis becoming widespread a PLC (so-called safety PLC) of an independentconstruction which is specialized for the safety management of thesystem in detecting the abnormality and the emergency state of thesystem as well as in automatically performing an emergency safety stopof the system. Patent Documents 1 and 2 noted below exemplifytechnologies relating to a so-called safety PLC like this.

As one of other technologies, FIG. 14 exemplifies a circuit diagram (innormal state) of a known input circuit 201 which is utilized in aprogrammable controller in the prior art. This input circuit 201 partlyand briefly shows an input circuit in actual use. In the presentcircuit, switches SW1 and SW0 constituting an emergency stop switch areduplexed and are normally closed contacts. Photo couplers 10, 20, 30 and40 are used in the operation state that electric current always flowstherethrough. When the switches SW1, SW0 are brought into open states,the electric current flowing through the photo couplers 10, 20 and theelectric current flowing through the photo couplers 30, 40 are cut offeither. In this way, duplex constructions are provided by a circuitsystem for inputting and processing an input signal from the switch SW1(the upper-half system of the illustrated input circuit 201 will bereferred to occasionally as A-system) and by another circuit system forinputting and processing an input signal from the switch SW0 (thelower-half system of the illustrated input circuit 201 will be referredto occasionally as B-system).

Then, with the duplexed constructions, when the input signal detected inthe A-system to indicate the open/close state of the switch SW1coincides with the input signal detected in the B-system to indicate theopen/close state of the switch SW0, the signals are treated as a normalinput signal, and the subsequent logic processing is executed to controlan output device. For example, when the depression of the emergency stopswitch brings the contacts into open states, the two input signalsoutputted from the switches become signals both indicating the openstates and come to coincidence, so that they are treated as a true inputsignal to execute an emergency stop processing for stopping theoperations of all the output devices.

On the contrary, when the input signals from the switch SW1 and theswitch SW0 of the two systems do not coincide, such is judged to be theoccurrence of an abnormality, in which event an abnormality stop, thatis, an emergency stop is performed to emergently stop all the outputdevices in a moment.

On one hand, the input circuits and the control devices therefor arealways self-diagnosed. The method therefor will be described hereunder.

In FIG. 14, symbols (a), (b), (c) and (d) respectively denote inverters(logic reversers). When a diagnosis pulse OA (signal L in the figure) isoutputted to the inverter (b) from an A-system control microcomputer(not shown) which controls the illustrated safety management, theelectric potential at a diagnosis pulse input terminal 40 a of the photocoupler 40 rises due to the reverse action of the inverter (b). Thus,since the emission of an LED built in the photo coupler 40 isdiscontinued temporarily for the period of the pulse (signal L) only,the normal current (i_(n)) flowing through the photo coupler 30 is onceinterrupted. As a consequence, a diagnosis result (response signal IB tothe diagnosis pulse OA) which is inputted to a B-system controlmicrocomputer (not shown) on the other side through the inverter (c) istemporally displaced from “1” to “0”.

FIG. 15-A shows this relation. That is, FIG. 15-A shows the relationbetween the diagnosis pulse OA and the response signal IB at the timewhen the aforementioned diagnosis pulse OA (signal L in the figure) isoutputted with the terminals P and Q being not short-circuitedtherebetween and with both of the switches Sw1 and SwO being closed. Thesame symmetrical relation holds at the time when a diagnosis pulse OB issent from the B-system control microcomputer conversely. FIG. 15-B showsthe relation between the diagnosis pulse OB and the aforementionedresponse signal IA in FIG. 14. These relations can be understood easilyin terms of the symmetry of the circuit.

For example, the aforementioned diagnosis wherein a sender side of thediagnosis pulse and a receiver side of the response signal to thediagnosis pulse are constructed by the different computers in this waywill be referred to as cross-diagnoses hereafter. In the cross-diagnoseslike this, however, between the microcomputers, there may be providedcommunication means or diagnosis result sharing means of theconfiguration that enables the diagnosis pulse sender side to makereference immediately to the aforementioned response signal received onthe receiver side.

By conducting the cross-diagnoses like this, it can be realized toalways monitor the conductive states between respective terminals (O, P,Q, R) and the operational state of the circuit through the complimentarycooperation, so that the duplexing and steady monitoring of the inputcircuit can be attained. Further, by making the diagnosis pulses crossmutually between the different systems, there can also be obtained anadvantage that the control microcomputer of the opposing system isalways monitored for the normal operation.

In the prior art system, in the aforementioned manner, the input circuit201 is duplexed by duplexing the transmission line for switch open/closesignals, switches themselves and so on as shown in FIG. 14, whereby thesafeness of the system can be ensured.

Patent Document 1 is Japanese unexamined, published patent applicationNo. 2004-46348, and Patent Document 2 is Japanese unexamined, publishedpatent application No. 2002-358106.

However, when a short-circuit occurs between the input terminals P and Qto the same input device whose input circuit 201 is duplexed as shown inFIG. 16, it results that the photo couplers for the A and B-systems areconnected directly, whereby there is generated a short-circuit current(is) shown in the figure. This causes electric current to continuinglyflow through the respective photo couplers 10, 20, 30, 40 regardless ofthe open/close states of the switches SW1, SW0. As a result, even whenthe emergency stop switches SW1, SW0 are brought into open states, eachof the aforementioned switch open/close signals (IA, IB) remains toindicate the closed states without changing. That is, both of them arealways held to remain at “1”. As a consequence, the abnormality causedby the short-circuit like this cannot be detected even by the use ofnon-coincidence detection means which has been known for monitoring thenon-coincidence between the response signals IA, IB duplexed asmentioned above.

When the duplexed switches are turned into the open states in the statethat a short-circuit is taken place between input terminals fordifferent input devices, the input signal to the system whose terminalhas not been short-circuited is brought into the open state, while theinput signal to the other system remains in the closed state. Thus, theduplexed signals are judged to be in non-coincidence, and an emergencystop processing is brought into operation immediately, so that noproblem arises.

On the other hand, description will be described regarding the case thatafter the occurrence of the aforementioned short-circuit, the emergencystop switches SW1, SW0 are brought into the open states and then, theaforementioned cross-diagnoses are carried out. Actually, since theinput circuit 201 as shown in FIG. 14 become needed by the numbercorresponding to the number of the devices to be controlled andperipheral devices therefor, the plurality of the input circuits 201shown in FIG. 14 are arranged in parallel. In this case, the prior artsafety PLC which is composed mainly of the aforementioned A-systemcontrol microcomputer and the B-system control microcomputer alwaysmonitors the safety of the system by repetitively executing theprocessing that the microcomputers read the states of respective inputterminals at respective parts of plurality of the input circuitsarranged in parallel in this way by cyclically outputting diagnosispulses to each terminal.

In this case, since the circuit has been short-circuited, it resultsthat electric current flowing through the short-circuited circuit in theother system is also interrupted by the diagnosis pulse, and thisphenomenon can be detected by the change in level of the input signal.Accordingly, even when the non-coincidence detection circuit does notoperate effectively, it becomes possible to detect the aforementionedshort-circuit fault based on the cyclic diagnosis insofar as the cyclicdiagnosis like this is always carried out.

However, since the cyclic diagnosis is carried out sequentially for therespective terminals, the diagnosis cycle at which the cyclic diagnosisis carried out is proportional to the number of objects to be diagnosed.Therefore, the cycle tends to become very long, as exemplificativelydescribed later with reference to FIG. 6 and the like. Therefore, thepresent situation is that it is hard to say that a required time takento detect the abnormality such as the aforementioned short-circuit canbe shortened sufficiently.

Further, since the diagnosis cycle in the cyclic diagnosis isproportional to the number of the input terminals of the input circuits,it is likely that the problem like this will increasing become prominentand actual as the system becomes large in scale.

The present invention is made to solve the aforementioned problems, andthe object thereof is to make it possible to perform a fault detectionreliably and to perform an emergency stop more reliably and quickly.

DISCLOSURE OF THE INVENTION

The following measures are effective in solving the aforementionedproblems.

That is, a first measure according to the present invention is aprogrammable controller wherein a plurality of external input devicesand a processing device for processing input signal group inputted fromthe external input devices are multiplexed by a plurality of systems andwherein upon coincidence between the input signal groups in all thesystems, correct input signals are judged to have been inputted whileupon non-coincidence therebetween, an abnormality stop processing isperformed, wherein the processing device in one system comprisesdiagnosis pulse output means for parallel outputting diagnosis pulsegroup to the processing device in another system at a timing unique tothe one system; check means for inputting thereinto diagnosis pulsesoutputted from diagnosis pulse output means in the another system andfor interrupting the transmission of the input signal group for theperiod of the diagnosis pulses only; and abnormality judgment means forexecuting an abnormality stop processing when a signal (response signal)of the input signal group (response pattern) changes in response to theoutputting of the diagnosis pulses from the diagnosis pulse output meansin its own system.

Multiplexing in the present invention is arbitrary in number. It is thefeature of the present invention that diagnosis pulses are paralleloutputted from one system to another system and that the state of theinput signal group to its own system which outputted the diagnosispulses is judged with the transmission of input signal group to theanother system being interrupted during the period of the diagnosispulses only. Since the systems are independent of each other, inputsignal group to its own system which is not inputting the diagnosispulses thereinto are not influenced by the diagnosis pulses unless anyfault is not occurring. However, when a short-circuit of a certain kindis occurring between terminals, a circuit is formed, whereby a signal ofthe input signal group to its own system changes as a result of beinginfluenced by the diagnosis pulses inputted to the another system. Withthis, any fault can be found in a moment to execute an emergency stopprocessing.

Generally, the input devices are supposed to comprise contacts ofswitches, relays and the like though not limited thereto in particular.Further, usually, it is often the case that these contacts are used asnormally closed contacts. In this case, the input circuits are used withelectric current being always applied, and when the switches are broughtinto open states, electric current flowing through the circuits isinterrupted, the change of which is taken as a significant input signal.

In the first measure of the first invention, diagnosis pulse groups areparallel outputted respectively at timings which are unique to eachother between the respective systems, and if the independency of theindividual system which independency is to be ensured for each of theparallel. multiplexed systems has been loosen at this time due to ashort-circuit or the like, a change is made of at least one signal, notto change normally, of the input signal group to its own system, andsuch a change is detected in its own system. Therefore, according to thefirst measure of the present invention, it can be detected that theindependency of at least its own system has been loosen. Thus, in theevent that the independency of the individual system which independencyis to be ensured for each of the respective multiplexed systems isloosen due to a short-circuit or the like, the aforementionedabnormality stop processing is executed, whereby a trouble caused by theshort-circuit or the like can be obviated.

Further, a second measure according to the present invention is aprogrammable controller constructed to be duplexed by first inputterminal group for inputting first input signal group which areoutputted from external input device group each constructed to beduplexed; a first signal processing device for processing the firstinput signal group inputted to the first input terminal group; secondinput terminal group for inputting second input signal group outputtedfrom the external input device group; and a second signal processingdevice for processing the second input signal group inputted to thesecond input terminal group, wherein a correct signal is judged to havebeen inputted when a first input signal being one element of the inputsignal group coincides with a second input signal paired with the firstinput signal while an abnormal processing is performed in the case ofnon-coincidence, wherein the first signal processing device comprisesfirst diagnosis pulse output means for parallel outputting firstdiagnosis pulse group to the second signal processing device; firstcheck means for parallel inputting thereinto second diagnosis pulsegroup outputted from the second signal processing device and forinterrupting the transmission of the first input signal group for theperiod of the second diagnosis pulse group only; and first abnormalityjudgment means for making a judgment of abnormality to execute anabnormality stop processing when the first input signal group change inresponse to the outputting of the first diagnosis pulse group from thefirst diagnosis pulse output means, and wherein the second signalprocessing device comprises second diagnosis pulse output means forparallel outputting the second diagnosis pulse group to the first checkmeans at a timing which is different from the outputting of the firstdiagnosis pulse group; second check means for parallel inputtingthereinto the first diagnosis pulse group outputted from the firstdiagnosis pulse output means and for interrupting the transmission ofthe second input signal group for the period of the first diagnosispulse group only; and second abnormality judgment means for making thejudgment of abnormality to execute the abnormality stop processing whenthe second input signal group change in response to the outputting ofthe second diagnosis pulse group from the second diagnosis pulse outputmeans.

This invention is constructed to take two in the number of multiplexing.Respective systems take symmetrical circuit constructions. As is thesame with the invention of Claim 1, the diagnosis pulses are outputtedto the other system, and an abnormality judgment is executed bydetecting the state of the input signal group in the system whichparallel outputted the diagnosis pulses. Where a switch being an inputdevice is brought into open state with the aforementioned short-circuitfault occurring and when the diagnosis pulses are inputted to interruptelectric current flowing through the circuit for the period of thediagnosis pulses, electric current flowing through the other circuit isalso interrupted. By judging the state of the input signal group fromthe other circuit which is not inputting the diagnosis pulses thereinto,it can be realized to detect an abnormal state. In this detection, sincethe diagnosis pulses are parallel outputted to the input terminal group,it becomes possible to complete the abnormality diagnosis after thedelay which is caused by the processing time of the input signal groupsubsequent to the output timing. Therefore, it becomes possible toperform an emergency stop without any delay after the change of anabnormality stop switch from the closed state to the open state.Strictly, the delay time at this occasion becomes a time which is takenonly by the cycle time for the outputting of the diagnosis pulses, thatis, becomes eighteen milliseconds or so for example.

Hereafter, the system in which the first signal processing device in thesecond measure according to the present invention controls the safetymanagement may be occasionally referred to as A-system, whereas theother system in which the second signal processing device of the othercontrols the safety management may be occasionally referred to asB-system.

In the second measure according to the present invention, the first andsecond diagnosis pulse groups are parallel outputted at unique timingswhich are different from each other between the A-system and theB-system. Thus, if the independency of the individual system whichindependency is to be ensured for each of the parallel duplexed systems(i.e., the A-system and the B-system) has been loosen at this time dueto a short-circuit or the like, at least one signal, not to changenormally, of the input signal group to its own system may change independence on input conditions, and at this time, such a change isdetected by its own system. Therefore, according to the second measureof the present invention, it can be detected based on the first orsecond abnormality judgment means that the independency of at least itsown system has been loosen. Thus, in the event that the independency ofthe individual system which independency is to be ensured for each ofthe respective duplexed systems is loosen due to short-circuit or thelike, the aforementioned abnormality stop processing is executed,whereby a trouble caused by the short-circuit or the like can beobviated.

For example, a short-circuit instance shown in FIG. 16 as aforementionedcan be recited as the case that the independencies of the systems havebeen loosen. In this case, the short-circuit has occurred between theterminals P and Q, and the short-circuit current (i_(s)) serially flowsthrough the A-system circuit (photo couplers 10 and 20) and the B-systemcircuit (photo couplers 30 and 40), in the respect of which theindependency between the A-system and the B-system has been loosen.

Further, at this time, under the condition that both of the switches SW1and SW0 are being opened, the abnormal or emergency state can bedetected based on the response pattern appearing at the time of sendingthe diagnosis pulses as shown in FIG. 1-A or 1-B. That is, it is safe tosay that the detection operation for the short-circuit fault exemplifiedin FIG. 1-A or 1-B is the instance utilizing the operation of thepresent invention.

Further, a third measure according to the present invention resides inthe aforementioned first measure, wherein the aforementioned abnormalityjudgment means judges an abnormality and performs an abnormality stopwhen a signal from the same input terminal of the input terminal groupchanges a predetermined number of times consecutively.

The reason of making judgment the predetermined number of timesconsecutively is for the measure against surrounding noise. A value isregarded correct if the same signal level is obtained the predeterminednumber of times consecutively, but is not regarded correct as a resultof being regarded as surrounding noise if not obtained. Therefore, asthe predetermined number of times increases, the anti-noise capabilitycan be enhanced, but the time is elongated to reach the emergency stop.In this point of view, the predetermined number of times is properly setto, e.g., ten times or so.

Further, a fourth measure according to the present invention resides inthe aforementioned second measure, wherein the aforementioned firstabnormality judgment means is made as means for making the judgment ofabnormality to perform an abnormality stop when a signal from the sameinput terminal of the first input signal group changes a predeterminednumber of times consecutively; and wherein the aforementioned secondabnormality judgment means is made as means for making the judgment ofabnormality to perform the abnormality stop when a signal from the sameinput terminal of the second input signal group changes a predeterminednumber of times consecutively.

The same as aforementioned in the third measure according to the presentinvention is applied to the aforementioned predetermined number oftimes.

According to the third or fourth measure of the present invention, whena signal from the same input terminal of the input signal group changesthe predetermined number of times consecutively, such is judged to beabnormal. Thus, even where the job site has much surrounding noise whichinfluences on the input signals, stable safety management can berealized without being influenced by such surrounding noise. The measurelike this for control stability is effective particularly at a job sitewhere there are many use of power machineries which generate suchsurrounding noise.

Further, a fifth measure according to the present invention resides inthe aforementioned first or third measure, wherein the signal processingdevice in one system is provided with serial diagnosis pulse outputmeans for serially outputting serial diagnosis pulses for each inputterminal to the processing device in another system; and pulse checkmeans for inputting serial diagnosis pulses which are outputted seriallyfor each input terminal from serial pulse output means of the processingdevice in the another system and for making the judgment of abnormalityto execute the abnormality stop processing when the input signals do notchange in correspondence to the period of the serial diagnosis pulses.

Further, a sixth measure according to the present invention resides inthe aforementioned second or fourth measure, wherein the aforementionedfirst signal processing device is provided with first serial diagnosispulse output means for serially outputting first serial diagnosis pulsesto the second check means for each input terminal; and first pulse checkmeans for inputting thereinto second serial diagnosis pulses which areserially outputted from the second signal processing device to the firstcheck means for each input terminal and for making the judgment ofabnormality to execute the abnormality stop processing when the firstinput signals do not change in correspondence to the period of thesecond serial diagnosis pulses, and wherein the second signal processingdevice is provided with second serial diagnosis pulse output means forserially outputting second serial diagnosis pulses to the first checkmeans for each input terminal; and second pulse check means forinputting thereinto the first serial diagnosis pulses which are seriallyoutputted from the first serial diagnosis pulse output means to thesecond check means for each input terminal and for making the judgmentof abnormality to execute the abnormality stop processing when thesecond input signals do not change in correspondence to the period ofthe first serial diagnosis pulses.

According to any one of the aforementioned first to fourth measures ofthe present invention, it is possible to verify the independenciesbetween the individual systems. However, these verifications (diagnoses)do not enable the verifications (diagnoses) to be conducted up to onsuch faults as improper interferences and short-circuits which occurbetween individual circuits in the individual system.

However, according to the fifth or sixth measure of the presentinvention, since the aforementioned serial diagnosis pulses are seriallyoutputted to each input terminal, the verifications (diagnoses) can beconducted up to on such faults as improper interferences andshort-circuits which occur between individual circuits in the individualsystem.

Further, a seventh measure according to the present invention resides inany one of the aforementioned first, third and fifth measures, whereinthe aforementioned check means comprises a photo coupler for inputtingthe input signal; and another photo coupler composed of a phototransistor connected in series to a light emitting diode of the photocoupler and a light emitting diode for generating an optical signal tothe photo transistor upon receiving a diagnosis pulse.

Circuits such as photo couplers or the like for processing signals areused with electric current being supplied always, and when a switch isbrought into open state, the electric current flowing through thecircuit is interrupted, the change of which is used as a significantinput signal.

Further, an eighth measure according to the present invention resides inany one of the aforementioned second, fourth and sixth measures, whereinthe aforementioned first check means comprises a photo coupler forinputting the first input signal; and another photo coupler composed ofa photo transistor connected in series to a light emitting diode of thephoto coupler and a light emitting diode for generating an opticalsignal to the photo transistor upon receiving a second diagnosis pulse,and wherein the second check means comprises a photo coupler forinputting the second input signal; and another photo coupler composed ofa photo transistor connected in series to a light emitting diode of thephoto coupler and a light emitting diode for generating an opticalsignal to the photo transistor upon receiving a first diagnosis pulse.

According to the seventh or eighth measure of the present invention, theswitching operations and the circuit interruption detection operationsof the circuits in executing the diagnoses are executed by the photocouplers. Because these signals are transmitted in the form of lightswith a predetermined wavelength, the following advantages can beobtained.

-   (1) It is possible to realize the switching operations and the    circuit interruption detection operations of the circuits stably in    the configuration that surrounding noise at the job site is hardly    picked up directly.-   (2) It becomes possible to limit the interfaces between the circuit    group on the diagnosing side and the circuit group on the diagnosed    side to optical interfaces only. Thus, independencies of the both    circuit groups are enhanced, so that it becomes easy to carry out    circuits designs such as, for example, power circuits individually    independently of one another.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1-A is a graph (in the event of a short-circuit) exemplifying therelation between diagnosis pulses and response pulses;

FIG. 1-B is another graph (in the event of a short-circuit) exemplifyingthe relation between diagnosis pulses and response pulses;

FIG. 2 is a circuit diagram of an input circuit 200 of a programmablecontroller in a first embodiment;

FIG. 3-A is a time chart relating to the operations of respectiveprocessors (100A and 100B);

FIG. 3-B is a graph exemplifying response patterns (input patterns ofrespective response signals);

FIG. 4 is a flow chart for cross-diagnosis (A-system) executed by amicrocomputer 100A;

FIG. 5 is a flow chart for cross-diagnosis (B-system) executed by amicrocomputer 100B;

FIG. 6 is a calculation table for a diagnosis cycle (T) depending on thenumber (N) of measurements and the number (M) of terminals;

FIG. 7 is a flow chart exemplifying the procedure for a self-diagnosis(A) executed by the microcomputer 100A;

FIG. 8 is a flow chart exemplifying the procedure for a self-diagnosis(B) executed by the microcomputer 100B;

FIG. 9 is a flow chart exemplifying the execution procedure for thesampling (A-system) of input signals;

FIG. 10 is a flow chart exemplifying the execution procedure for thesampling (B-system) of input signals;

FIG. 11 is a flow chart exemplifying the execution procedure for amajority processing (B-system);

FIG. 12 is a flow chart exemplifying the execution procedure fornon-coincidence detection;

FIG. 13 is a flow chart exemplifying the preparation procedure for amajority word (MA);

FIG. 14 is a circuit diagram (in normal state) of a prior art inputcircuit 201;

FIG. 15-A is a graph (in normal state) exemplifying the relation betweendiagnosis pulses and response pulses;

FIG. 15-B is another graph (in normal state) exemplifying the relationbetween diagnosis pulses and response pulses; and

FIG. 16 is a circuit diagram (in the event of a short-circuit) of theprior art input circuit 201.

PREFERRED EMBODIMENT TO PRACTICE THE INVENTION

Hereafter, the present invention will be described by reference tospecific embodiments.

However, the present invention is not limited to individual embodimentsdescribed hereunder.

First Embodiment

FIG. 2 shows an input circuit 200 of a programmable controller in thefirst embodiment. Input terminals O and P constitute first inputterminals by these two terminals. Further, likewise, input terminals Qand R constitute second input terminals. Switches SW1 and SW0 are thoseduplexing a manual emergency stop button, and when the emergency stopbutton is pushed, both of the switches SW1 and SW0 are openedsimultaneously. That is, when the emergency stop button is pushed,electrical connection is cut off both between the input terminals O, Qand between the input terminals P, R. The emergency stop button is onerepresenting an external input device, and in fact, a plurality of otherexternal input devices (not shown) are arranged and connected in thesame manner as the emergency stop button in parallel relation with theemergency stop button. The external input devices are optional, andthere are connectable contacts of various kinds such as, for example,switches, limit switches, relays, sensors and so on.

However, it is necessarily required to duplex input circuits for theexternal input devices which are little in a risk that the safety underthe job site environment is endangered by the mulfunction of the devicesas well as for external input devices which do not involve such a risk.

Hereafter, description will be made regarding the case that duplexing isprovided in any of respective input circuits corresponding respectivelyto respective external input devices.

The input terminal O in FIG. 2 is constituted as a direct current powerterminal of +24 volts. Further, the input terminal R is kept at theground level (±0 volts). Then, since the switch SW1 in FIG. 2 isnormally closed in the ordinary state, direct current voltage of stable24 volts is normally applied to between the input terminals O and P inthe ordinary state. Likewise, since the switch SW0 is also normallyclosed in the ordinary state, direct current voltage of stable 24 voltsis normally applied also to between the input terminals Q and R in theordinary state.

On the other hand, on the right side (on the side of the microcomputer100A and the microcomputer 100B) of the boundaries which are made byoptical interfaces of respective photo couplers, any circuit isconstituted under a 5-volt power system. That is, any of the voltagesV_(B) and V_(A) is set to +5 volts.

Always flowing normally in the ordinary state is electric current whichflows from an LED provided in a photo coupler 10 in FIG. 2 to a phototransistor provided in a photo coupler 20. This is because in theordinary state, electric current always flows through an LED provided inthe photo coupler 20. Likewise, always flowing in the ordinary state iselectric current which flows from an LED provided in a photo coupler 30in FIG. 2 to a photo transistor provided in a photo coupler 40. This isbecause in the ordinary state, electric current always flows through anLED provided in the photo coupler 40.

Because in the same manner as the aforementioned emergency stop button,the aforementioned plurality of external input devices (not shown) areconnected in parallel to the aforementioned emergency stop button, thefirst input terminals make a group. Hereafter, the group is referred toas first input terminal group. Further, a second input terminal groupincluding the aforementioned second input terminals is defined likewise.Input signals outputted from respective external input devices andinputted to the first input terminal group will hereafter be referred toas first input signal group. Further, input signals outputted from therespective external input devices and inputted to the second inputterminal group will hereafter be referred to as second input signalgroup.

The input circuit 200 in FIG. 2 has the first input terminals (O, P) anda first signal processing device 1000A, which constitute an upper-halfsystem. Hereafter, this system will be referred to as A-system. Further,the input circuit 200 has the second input terminals (Q, R) and a secondsignal processing device 1000B, which constitute a lower-half system.Hereafter, this system will be referred to as B-system.

A logic reverser (inverter (a)) is arranged at an input section of anA-system control microcomputer 100A which controls the safety managementfor the A-system. Accordingly, a signal outputted from the photo coupler10 and inputted to the microcomputer 100A through the inverter (a) isinverted in the level of H/L (i.e., “1”/“0”) before and after theinverter (a). Other inverters (b), (c) and (d) perform the same reversefunction.

First diagnosis pulse output means 110A is arranged at an output sectionof the microcomputer 100A. The first diagnosis pulse output means 110Ais capable of simultaneously and parallel outputting diagnosis pulses tophoto couplers (not shown) of other external input devices being inparallel connection as well as to the photo coupler 40. Of course, inthe same manner as done by the prior art system, it is possible tooutput diagnosis pulses to the separate external input devices seriallyin turn and individually.

On the other hand, a microcomputer 100B is the B-system controlmicrocomputer which controls the safety management for the B-system, andis constructed and arranged in the same manner as the aforementionedmicrocomputer 100A and symmetrically with the aforementionedmicrocomputer 100A, except for the respect that there is additionallyprovided a diagnosis circuit which is composed mainly of a photo coupler50 for direct current power supply diagnosis.

For example, second diagnosis pulse output means 110B is arranged at anoutput section of the microcomputer 100B, and the second diagnosis pulseoutput means 110B is capable of simultaneously and parallel outputtingdiagnosis pulses to photo couplers (not shown) of the aforementionedother external input devices being in parallel connection as well as tothe photo coupler 20. Of course, in the same manner as done by the priorart system, it is possible to output diagnosis pulses to photo couplers(check means) corresponding to the separate external input devices,serially in turn and individually.

The photo couplers 10 and 20 constitute the part corresponding to firstcheck means in the present invention. Since the pair of photo couplerslike these are arranged respectively in each of the input circuits ofthe A-system which correspond to the respective input devices, so thatit becomes possible to interrupt the transmission of the first inputsignal group momentarily. Further, likewise, the photo couplers 30 and40 constitute the part corresponding to second check means in thepresent invention. Thus, it becomes possible to interrupt thetransmission of the second input signal group momentarily.

That is, it is the diagnosis pulses that control the interruption, andwhere the parallel (simultaneous) transmissions are made asaforementioned, it is possible in each case to simultaneously interruptthe first input signals by the first diagnosis pulse output means 110Aand the second input signals by the second diagnosis pulse output means110B.

FIG. 3-A exemplifies a time chart relating to the operation of each ofthe aforementioned microcomputers (100A and 100B). The base controlcycle ΔT of the microcomputer 100A, 100B is set to 18 milliseconds.Those times illustrated represent respective times (t) within thecontrol cycle which are set on the basis of a start time of the controlcycle. For example, the illustrated cross-diagnoses are executed in atime zone which is a part between 13.5 milliseconds and 15.5milliseconds of the time (t) within the control cycle. Both of themicrocomputers 100A and 100B are used for the cross-diagnoses.

Further, the microcomputer 100A only is used for a self-diagnosis (A)executed in a time zone which is a part between 15.5 milliseconds and16.5 milliseconds of the time (t) within the control cycle. Further, themicrocomputer 100B only is used for a self-diagnosis (B) executed in atime zone which is a part between 16.5 milliseconds and 17.5milliseconds of the time (t) within the control cycle.

Cross-Diagnoses

FIG. 3-B exemplifies response patterns (input patterns of respectiveresponse signals IA(m) and IB(m)) corresponding to the diagnosis pulses.Here, the natural number (m) is a serial number which is allotted toeach external input device in consecutive order, and hereafter, in thepresent embodiment, the maximum value of (m) is assumed to be 24.

In the self-diagnosis B, the response signal IA(m) (1≦m≦24) inputted tothe A-system microcomputer 100A ought to change based on the diagnosispulse OB(m) (1≦m≦24) which is outputted from the second diagnosis pulseoutput means 110B, provided in the B-system microcomputer 100B, to thefirst check means in parallel with other diagnosis pulses. However, atthis time, if the independencies of the A and B-systems in the inputcircuit 200 have been secured and maintained, no change ought to be madewith the response signal IB(m) (1≦m≦24) inputted into the B-systemmicrocomputer 100B, as already considered earlier with reference to FIG.14 and FIG. 15-B.

Accordingly, when an exceptional signal exemplified in FIG. 3-B isdetected, it is considered that there has occurred an abnormal situationas referred to earlier with reference to FIG. 1-B.

Hereafter, detail exemplification will be made regarding the controlprocedures which the microcomputers 100A and 100B should execute todetect such an abnormality.

FIG. 4 exemplifies a flow chart of the cross-diagnosis (A-system)executed by the microcomputer 100A. This cross-diagnosis embodies sixthmeasure in the present invention, by which the cross-diagnoses in FIG.3-A are realized. That is, the diagnosis pulse OA(m) in this figure is adiagnosis pulse for diagnosing the A-system input circuit of the m-thexternal input device as described above, and is outputted to the secondcheck means. In the cross-diagnosis in FIG. 4, this output is carriedout serially to the respective external input devices. This program 700is analogous to a program 800 in FIG. 5 for executing thecross-diagnosis (B-system) and is configured symmetrically andcomplementarily therewith. The cross-diagnoses in FIG. 3-A are realizedin accordance with the program 700 and the program 800.

Under this program 700, first of all, the initialization of controlvariables is executed at step 710. A control variable (m) alwaysindicates the serial number of an external input device to be diagnosed.Further, a control variable (n) indicates the number of times throughwhich the same diagnosis operation is repeated with the input circuit(A-system) of the same external input device. The reason why suchrepetition is performed is to realize the aforementioned fourth measurein the present invention.

At next step 720, a timer-interrupt is waited. This timing suffices tobe the timing of t=13.5 [milliseconds], as shown in FIG. 3-A. That is, asubroutine at step 730 is executed at this timing, whereby a samplingprocessing in FIG. 9 for the input signals is initiated. The samplingprocessing for the input signals is to determine the signals (firstinput signal group and second input signal group) inputted to the inputcircuit 200, through a predetermined statistical operation. Although theprocedure for the statistical operation will be described later indetail, the statistical operation is executed for the countermeasuresmainly against disturbances such as noises or the like. However, theeffect is not necessarily limited only to the countermeasures againstdisturbances.

A response signal IB(i) held on the microcomputer 100B side can bereferred to at any time from the microcomputer 100A side by way of abus, a shared memory or the like between the both microcomputers. Thus,at step 740, the response signals IA(i) (1≦i≦24) inputted to themicrocomputer 100A are all (24 bits) stored in predetermined evacuationareas, and the response signals IB(i) (1≦i≦24) inputted to themicrocomputer 100B are also all (24 bits) stored in predeterminedevacuation areas.

The diagnosis pulses OA(i) and the diagnosis pulses OB(i) have notearlier been issued at this timing. Thus, at a later step 780, if it isconfirmed that the response signals IA(i) (1≦i≦24) are “1” at all thebits, it can be judged that these input bits (the first input signalgroup) are normal. Further, the same is true with the second inputsignal group (responsive signals IB(i)).

At step 750, a diagnosis pulse OA(m) is outputted to the B-system checkmeans of the m-th external input device. Since at step 850,corresponding to the step 750, of the program 800 in FIG. 5 which isconfigured to be analogous and symmetrical with the present program 700,a diagnosis pulse OB(m) is outputted at almost the same time to theA-system check means of the m-th external input device, theaforementioned cross-diagnoses can be realized based on thecross-relation of these diagnosis pulses. However, in a strict sense,the respective pulses OA(m) and OB(m) are outputted at mutuallyexclusive timings, as referred to later.

At step 760, the same processing as the aforementioned step 740 isexecuted. However, of course, the evacuation areas for input data areprovided separately. It is possible to execute the abnormality judgmentat step 780 based on diagnosis data for one-hundred times which havebeen stored respectively in these evacuation areas.

A series of processing (α) composed of three steps from step 740 to step760 and a series of processing (β) composed of three steps from step 840to step 860 in FIG. 5 referred to later are executed at differenttimings and mutually exclusively. The synchronization for executing thisexclusive control may be realized by making the microcomputers 100A and100B apply interrupts in turn to each other.

Further, steps 770 through 774 are the steps of realizing the control inwhich the aforementioned storage processing of the input data arerepetitively executed through one-hundred times. That is, thisrepetitive control embodies fourth measure in the present invention.

At step 780, it is judged whether or not abnormality is involved in theA-system input circuit of the m-th external input device. Where theabnormality is detected here based on the aforementioned diagnosis data,a subroutine for the issuance of an emergency safety stop order iscalled up at step 785, whereupon all the processing of the presentprogram 700 are terminated to return the control to the caller.

Steps 790 through 794 are for executing a repetitive control whichrealizes cyclic processing for the external input devices to whichtwenty-four units in total are connected.

Also under the program 800 in FIG. 5, the equivalent processing for theB-system is executed in a parallel time relation in the same manner asthat under the aforementioned program 700. Then, by mutually crossingthe diagnosis pulses between the different systems in this manner (thatis, by alternately executing the aforementioned processing (α) and (β)as the same are controlled exclusively with each other), there can beobtained at the same time an advantage that the microcomputer for thecontrol of the opposing system is always monitored about whether to benormal in operation or not.

As understood also from FIG. 3-A, the base control cycle in which theinterrupt waiting at each of the steps 720 and 820 in FIGS. 4 and 5 isreleased is ΔT=18 milliseconds. Therefore, the cycle at which the cycliccontrol passes through the respective cyclic points (a) shown in FIGS. 4and 5 becomes 18 milliseconds too. Further, since the cross-diagnoses ofone external input device are executed one-hundred times as mentionedearlier, the cycle at which the cyclic control passes through therespective cyclic points (b) shown in FIGS. 4 and 5 becomes 100ΔT=1800milliseconds. Further, since the external input devices of twenty-fourunits in total are in connection in the present embodiment, the cycle atwhich the cyclic control passes through the respective cyclic points (c)shown in FIGS. 4 and 5 becomes 24×100ΔT=43.2 seconds.

FIG. 6 shows the summary of these relations. That is, FIG. 6 shows thecalculation of the diagnosis cycle (T) necessary for the aforementionedcross-diagnoses which cycle depends on the number N of measurements andthe number M of terminals (the number of the total units of the externalinput devices). The aforementioned cross-diagnoses executed inaccordance with the programs 700 and 800 tend to be elongated in thediagnosis cycle (T) though they are excellent in the minutenessregarding the states of individual input terminals. For this reason, itis not always possible that detections regarding the occurrences ofshort-circuit fault, emergency situation and the like can be executednecessarily within a sufficiently short period of time.

However, in the first embodiment, as shown in FIG. 3-A, theself-diagnosis (A) and the self-diagnosis (B) for verifying theindependencies of the respective systems (A-system and B-system) in theparallel duplexed configuration can be executed each within a shortperiod of time, so that it can be realized to reliably detect theshort-circuit fault and the emergency situation as exemplified in FIGS.1-A and 1-B, in a shorter diagnosis cycle than before.

Self-Diagnosis

FIG. 7 exemplifies the procedure for the self-diagnosis (A) executed bythe microcomputer 100A. The procedure of the self-diagnosis (A)exemplified by this flow chart is somewhat similar to the procedure forthe cross-diagnosis (A-system), but is substantially completelydifferent from the cross-diagnosis (A-system) in the following tworespects (1) and (2).

-   (1) While the microcomputer 100A is executing the processing for the    self-diagnosis (A) shown in FIG. 7, the second diagnosis pulse    output means 110B of the B-system microcomputer 100B is not used    utterly. Further, the B-system microcomputer 100B does not utterly    execute the processing relating to at least the processing for the    self-diagnosis (A) shown in FIG. 7 and is basically to be placed in    the state waiting for an interrupt. However, the microcomputer 100B    may be allowed to execute a statistical processing for input    signals, response signals and so on as its background processing.

Accordingly, the independencies of the diagnosis processing can besecured by shifting the output timings of the diagnosis pulses betweenthe program 300 (FIG. 7) and the program 400 (FIG. 8) in this way. Thatis, the cross-diagnoses wherein diagnosis pulses are mutually crossedbetween the different systems are not executed in the self-diagnosis (A)in FIG. 7.

For this reason, it can be realized to briefly verify the independenciesof the A and B-systems on the A-system side.

-   (2) The first diagnosis pulse group are outputted by the first    diagnosis pulse output means 110A simultaneously in parallel    relation. Thus, cyclic control is unnecessary for the respective    external input devices.

For this reason, it can be realized to verify the independencies of theA and B-systems on the A-system side in a short period of time.

Specifically, the following processing is executed in accordance withthe program 300 (self-diagnosis (A)) in FIG. 7.

That is, under the program 300, first of all, a control variable isinitialized at step 310. This control variable (n) indicates the numberof times by which the diagnoses pulses are outputted. The reason whysuch a repetition is executed is to realize the aforementioned fourthmeasure in the present invention.

A timer-interrupt is waited at next step 320. This timing suffices to bethe timing of t=15.5 [milliseconds] as shown in FIG. 3-A. That is, asubroutine at step 330 is executed at this timing, whereby there isinitiated an input signal sampling processing in FIG. 9 described laterin detail. The input signal sampling processing is to determine thesignals (first input signal group and second input signal group)inputted to the input circuit 200, through a predetermined statisticaloperation which mainly takes a non-coincidence detection processing.

Step 335 is for executing the same processing as the aforementioned step740. Of course, the evacuation areas for the input data are providedseparately. The A-system response signals IA are all (twenty-four bitsin total) stored at step 335 here and subsequent step 350. In addition,at the same time, the B-system response signals IB may be also allstored like the aforementioned step 740 or 760 in FIG. 4.

Then, an abnormality judgment at step 380 is carried out based on thediagnosis data for ten times which have been stored in the evacuationareas therefor.

At step 340, the diagnosis pulses OA (i) (1≦i≦24) are all outputtedparallel at the same time from the first diagnosis pulse output means110A through the inverter (b) to the B-system check means (second checkmeans) composed of the photo couplers 30, 40 and the like. As the secondcheck means, there are parallel provided twenty-four pairs eachincluding the pair of the photo couplers 30 and 40. Since electriccurrent to an LED provided in the B-system photo coupler 40 in FIG. 2for example is interrupted temporally upon the parallel outputting ofthe diagnosis pulses, electric current to an LED provided in the photocoupler 30 is also interrupted temporally. That is, the interruptionlike this takes place at all of the aforementioned twenty-four pairs.

The same processing as the aforementioned step 740 is executed at step350. However, of course, the evacuation areas for the input data areprovided separately. The abnormality judgment at step 380 can be carriedout based on the diagnosis data for ten times which have been storedrespectively in these evacuation areas and the diagnosis data for tentimes which have been stored respectively in the evacuation areas at theaforementioned step 335. That is, steps 360 through 364 are those stepsfor realizing the control which repetitively executes the aforementionedstoring processing of the input data through ten times. The reason whysuch repetition is performed is to realize the aforementioned fourthmeasure in the present invention.

Thereafter, at step 380, the respective response signals IA (i) (1≦i≦24)are checked to make a judgment of abnormality if any one of the inputsignals IA (i) (1≦i≦24) is all zero over the consecutive ten times, thatis, if it is detected even at one place that electric current isimproperly cut off by the A-system check means (first check means).

Then, when the abnormality is detected, the subroutine for the issuanceof the emergency safety stop order is called up at step 390, whereuponall the processing of the present program 300 are terminated to returnthe control to the caller.

As shown in FIG. 3-A and FIG. 8, one millisecond behind the executiontime of the program 300 in FIG. 7, the program 400 in FIG. 8 is executedto be processed in the same manner as the program 300. Theindependencies of the self-diagnosis (A) and the self-diagnosis (B) canbe secured by sufficiently shifting the execution time of the program400 from that of the program 300. That is, during each self-diagnosis(A) or (B), it does not take place that the diagnosis pulses are crossedeach other.

The cycle at which the repetitive control passes through the respectivecyclic points (d) shown in FIGS. 7 and 8 becomes 10ΔT=180 milliseconds.That is, the cycle at which the step 364 in the execution of theself-diagnosis (A) or the step 464 in the execution of theself-diagnosis (B) (each diagnosis cycle (T) for the self-diagnosis (A)and the self-diagnosis (B)) is executed becomes 0.18 seconds, asunderstood also from FIG. 6. This time length is within a delay timewhich a worker is supposed to take in depressing the emergency stopbutton for system stop at an emergency time for example and thus, can bethe length which is sufficiently within a permissible range.

In the event of an emergency state exemplified in FIGS. 1-A and 1-B forexample, the control method like this makes it possible to detect such astate quickly and to secure the safety.

Hereafter, with reference to FIGS. 9 through 13, exemplification will bemade regarding the execution procedure which executes the aforementionedinput signal sampling processing and the detection processing for thenon-coincidence between the duplexed input signals at a high speed.

Sampling and Judgment of Input Signal Group

FIG. 9 is a flow chart exemplifying the execution procedure for inputsignal sampling (A-system). First input signal group IA′ are inputted atthe first step 520A of this program 500A. The first input signal groupIA′ are outputted to the microcomputer 100A from the same inverter (a)(input section in FIG. 2) as for the response signals IA. The firstinput signal group IA′ are not the response signals to the diagnosispulses OB, but are the input signals inputted to the input circuits 200relating to the A-systems of the respective external input devices, sothat respective bits thereof correspond respectively to the respectiveexternal input devices (twenty-four units in total). The inputted firstinput signals group IA′ are held in a one-word area having thirty-twobits for one word, in the form of right justification. The higher eightbits are set to be always zero or are disregarded.

Next, at step 540A, predetermined twenty-four bit data in a similarone-word area MA(i) are respectively brought into the calculations oflogical product (AND) with the aforementioned first input signal groupIA′ on a bit-by-bit basis. Here, the integers (i) are arguments for anarray MA and are separately allocated for respective times (t) withinthe base control cycle ΔT, as shown in the figure. Then, the results ofthe logical calculations are held in the one-word area MA(i). As theinitial values in the one-word area MA(i), “0” is set at each of theleft eight bits, while “1” is set at each of the right twenty-four bits.

At step 560A, the number of times the step 540A has been executed iscounted by a control variable (h).

In accordance with these procedures, where an input signal which becamezero even once during the five-time samplings of the first input signalgroup IA′, the value of a corresponding bit in the one-word area MA(i)is held by the action of the logical product calculation (AND command)to be zero consecutively thereafter. That is, the input signal whichbecame zero (i.e., OFF state) even once during the five-time samplingsis thereafter stored to be zero consecutively in the one-word areaMA(i). In this way, it becomes possible to store the results of theaforementioned five-time diagnoses in the one-word area MA(i) in theform condensed on the bit-by-bit basis.

FIG. 10 is a flow chart exemplifying the execution procedure for inputsignal sampling (B-system). Although being analogous to theaforementioned program 500A, this program 500B is slightly differenttherefrom in the definitions of arguments (i) and (k) in dependence onthe timings at which it is called up, as understood from FIG. 3-A andFIGS. 7 through 9. For example, as shown in the row for “Input Sampling”in FIG. 3-A and FIG. 10, the values of the second input signal group IB′are sampled at each of three times including t=13.5 milliseconds, 16.5milliseconds and 17.5 milliseconds within the same control cycle. As aresult that this is repeated through five cycles, sampled data forfifteen times in total are divided and. stored in three storage areasMB(1), MB(2) and MB(3) for the respective times (t) in the formcondensed through the aforementioned logical calculations.

FIG. 11 is a flow chart exemplifying the execution procedure formajority processing (B-system). Under this program 900B, after thesampled data for the fifteen times in total are divided asaforementioned into diagnosis data, each including those for five times(five control cycles), for the three storage areas MB(1), MB(2) andMB(3) for the respective times (t) and are stored in the respectivestorage areas MB(k) through the logical product calculations at step540B, the majority between respectively corresponding bits of the threewords MB(1), MB(2) and MB(3) is decided at step 940B with respect toeach of the twenty-four bits respectively corresponding to the externalinput devices.

Subsequently, at step 950B, a majority word MB which holds the resultsof the majority for respective bits is transmitted from themicrocomputer 100B to the microcomputer 100A. At those steps subsequentto step 960B, the initial values (X) for the aforementioned three wordsMB(1), MB(2) and MB(3) are set again. As mentioned earlier, the initialvalues (X) are set to take “0” at each of the left eight bits and “1” atall of the right twenty-four bits.

FIG. 12 is a flow chart exemplifying the execution procedure fornon-coincidence detection. This program 900A is configured to have steps910A through 970A which are almost the same as those of theaforementioned program 900B, symmetrically with the program 900B.However, in place of transmitting the majority word MB at step 950B(FIG. 11), the program 900A receives the majority word MB from themicrocomputer 100B at step 970A (FIG. 12). The transmission andreception may be realized by sharing a primary storage device or may berealized by the use of a bus or the like.

At step 975A of this program 900A, judgment is made of whether or notthe majority word MA prepared at step 940A coincides with the majorityword MB prepared at step 940B. As a result, the control is moved to step980A if the both words are in coincidence, but to step 990A if not incoincidence. At step 980A, either of the majority word MA and themajority word MB is transmitted (outputted) to a conventional sequencer(sequence controller or sequential circuit; not shown) which is inconnection with the microcomputer 100A.

On the other hand, when the majority word MA and the majority word MB donot coincide, the emergency safety stop order is issued at step 990A toexecute a predetermined emergency safety stop operation. Usually, theemergency safety stop order is outputted as a predetermined stop signalto respective stop means which are connected to a safety PLC output portprovided in the microcomputer 100A or 100B. As these stop means, theremay be connected emergency stop brakes, power breakers, motors or thelike.

FIG. 13 is a flow chart exemplifying the preparation procedure for theaforementioned majority word MA. Although this program 600A isconfigured to prepare the majority word MA for the A-system, it ispossible to execute similar logic calculations also in the B-system.This program 600A is a subroutine which is called up at theaforementioned step 940A to be executed. Of course, it may be configuredin the form of an extractable macro.

Under this program 600A, logical products of the aforementioned wordsMA(1) and MA(2) which are obtained under the program 500A are calculatedand are stored as variables Y1. Of course, the logical products areexecuted between the respective bits corresponding to each other.

In the same manner, also at steps 620 and 630, logical products of thewords MA(2) and MA(3) and logical products of the words MA(3) and MA(1)are stored respectively as variables Y2 and Y3.

At step 640, logical sums of the variables Y1 and Y2 calculated here arecalculated to renewedly store the calculation result as the variablesY2.

At next step 650, logical sums of the variables Y2 and Y3 calculatedhere are further calculated to store the calculation result as themajority word MA.

According to the aforementioned processing, it is possible to calculatea desired majority word MA at a high speed through the aforementionedfive steps 610 through 650 (by five logical operation commands).

In accordance with the aforementioned processing methods shown in FIGS.9 through 13, the processing executed at the upper row in FIG. 3-A, thatis, the input signal sampling processing and the non-coincidencedetection processing to be executed based on the sampled data can beexecuted each at a high speed through the simple and high-speed logicaloperations.

Other Modifications

The present invention is not limited to the aforementioned embodimentand may be modified as will be exemplified hereafter. The presentinvention can achieve the effects based on the operation of the presentinvention even in the modifications and applications describedhereafter.

First Modification

For example, in the self-diagnosis (FIG. 7) in the aforementioned firstembodiment, all the bits of the response signal IA are stored every timerespectively in the predetermined evacuation areas at step 350. However,in dependence on the judgment method at the subsequent step 380, it isnot necessarily required to do so.

The step 540A (FIG. 9) and the step 540B (FIG. 10) are configured byutilizing a judgment criterion that if a signal of the value “0” (OFFsignal indicative of the interruption of the input) is inputted evenonce of the five times, that bit is judged to be “0”. For example, itmay be the case that by utilizing the judgment criterion adequately, itbecomes possible to dynamically execute the most part of the judgmentprocessing, so that the evacuation areas for reference data (inputsignals) can be suppressed to the minimum.

Second Modification

Further, although in the foregoing first embodiment, the duplexing ofthe input circuit has been practiced with the two systems separatelyincluding the A-system and the B-system, the multiplexing of the inputcircuit may be realized in a triplexing form or may be realized in aquadruplexing form. For example, where the input circuit is triplexed bythree systems including the A-system, the B-system and the C-system, itbecomes possible to apply the majority theory to the non-coincidencedetection processing method in the non-coincidence detection means or todynamically reduce the triplexed system to the duplexed system where anabnormality occurs in one system only. Therefore, it becomes alsopossible to greatly reduce the chances for the system stops.

By constructing the means in the present invention properly, it ispossible to lead the operation of the present invention regardless ofthe multiplexing of these means. That is, the substantive operationprinciple of the present invention does not relate directly to thedegree of multiplex in implementing the multiplexing of the system.

Third Modification

Further, in the foregoing first embodiment, both of the self-diagnosis(A) and the self-diagnosis (B) are executed at the different timings.However, even where there is used a mode in which either one only of theself-diagnosis (A) and the self-diagnosis (B) is executed, it ispossible to obtain the effect of the short-circuit detection by theaction of the aforementioned self-diagnosis (A) or (B) in the foregoingfirst embodiment.

This is because as understood from FIGS. 1-A and 1-B, the ordinaryshort-circuit fault is detectable by either of the self-diagnosis (A).and the self-diagnosis (B) thanks to the symmetry of the input circuit,so that the omission of either one does not result in any particulardifficulty.

However, for the reason that the self-diagnosis (A) and theself-diagnosis (B) are controllable by almost the same program 700/800,that it is possible or easy to secure within one control cycle theperiod for executing the diagnoses at different times, that there arecircumstances to secure the certainty and reliability in the processingby duplexing the processing concerned, or that the temporal storagedevice has superabundance in capacity, it may of course be not a fewcases that it is better to duplex the processing concerned (theaforementioned self-diagnosis).

On the other hand, it may also be the case that the aforementioned basecontrol cycle ΔT can be further shortened by optimally designing thecontrol period of time with omission of, e.g., the self-diagnosis (B).In this case, advantage can be obtained in such a respect that thediagnosis cycle (T) or the like can be shortened or that it becomesunnecessary to prepare and handle the program 400.

Fourth Modification

Further, although the foregoing first embodiment rests on the premisethat each of the individual input circuits relating to the respectiveexternal input devices has been duplexed, it is not necessarily requiredto duplex respective input signals from all the external input devices.That is, with respect to devices (external input devices) which have norisk of leading to the occurrence of any emergency situation forexample, it is sufficient to transmit input signals to input circuits ina single mode. Further, it is needless to say that the execution of anon-coincidence detection processing such as, e.g. that in theaforementioned first embodiment is not required for any input signalwhich is not duplexed like this.

INDUSTRIAL APPLICABILITY

The present invention is greatly useful in securing at a high level thereliability on input signals inputted to a programmable controller(PLC), the certainty in the processing for those input signals and thesystem safeness which is to be secured based thereon, and hence, can beeffectively utilized in sequence control or the like for the operationsof robots, machine tools and peripheral devices thereof.

Further, where the aforementioned external input devices are supposed toinclude variable sensors (detection devices), information processingdevices and the like, the present invention can be utilized also in anauto cruise system for a motor vehicle, whereby it may be the case thata safer auto cruise system can be constructed.

1-8. (canceled)
 9. A programmable controller wherein a plurality ofexternal input devices and a processing device for processing an inputsignal group inputted from the external input devices are multiplexed bya plurality of systems and wherein upon coincidence between the inputsignal groups in all the systems, correct input signals are judged tohave been inputted while upon non-coincidence therebetween, anabnormality stop processing is performed, wherein the processing devicein one system comprises: diagnosis pulse output means for paralleloutputting a diagnosis pulse group to the processing device in anothersystem at a timing unique to the one system; check means for inputtingthereinto diagnosis pulses outputted from the diagnosis pulse outputmeans in the another system and for interrupting transmission of theinput signal group for the period of the diagnosis pulses only; andabnormality judgment means for executing an abnormality stop processingwhen a signal of the input signal group changes in response to theoutputting of the diagnosis pulses from the diagnosis pulse output meansin its own system.
 10. A programmable controller constructed to beduplexed by a first input terminal group for inputting a first inputsignal group which is outputted from an external input device group eachconstructed to be duplexed; a first signal processing device forprocessing the first input signal group inputted to the first inputterminal group; a second input terminal group for inputting a secondinput signal group outputted from the external input device group; and asecond signal processing device for processing the second input signalgroup inputted to the second input terminal group, wherein a correctsignal is judged to have been inputted when a first input signal beingone element of the first input signal group coincides with a secondinput signal paired with first input signal while an abnormal processingis performed in the case of non-coincidence, wherein the first signalprocessing device comprises: first diagnosis pulse output means forparallel outputting a first diagnosis pulse group to the second signalprocessing device; first check means for parallel inputting thereintosecond a diagnosis pulse group outputted from the second signalprocessing device and for interrupting transmission of the first inputsignal group for the period of the second diagnosis pulse group only;and first abnormality judgment means for making a judgment ofabnormality to execute an abnormality stop processing when the firstinput signal group changes in response to the outputting of the firstdiagnosis pulse group from the first diagnosis pulse output means, andwherein the second signal processing device comprises: second diagnosispulse output means for parallel outputting the second diagnosis pulsegroup to the first check means at a timing which is different from theoutputting of the first diagnosis pulse group; second check means forparallel inputting thereinto the first diagnosis pulse group outputtedfrom the first diagnosis pulse output means and for interruptingtransmission of the second input signal group for the period of thefirst diagnosis pulse group only; and second abnormality judgment meansfor making the judgment of abnormality to execute the abnormality stopprocessing when the second input signal group changes in response to theoutputting of the second diagnosis pulse group from the second diagnosispulse output means.
 11. The programmable controller described in claim9, wherein: the abnormality judgment means makes a judgment ofabnormality and performs an abnormality stop when a signal from the sameinput terminal of the input signal group consecutively changes apredetermined number of times.
 12. The programmable controller describedin claim 9, wherein: the first abnormality judgment means makes thejudgment of abnormality to perform an abnormality stop when a signalfrom the same input terminal of the first input signal groupconsecutively changes a predetermined number of times; and the secondabnormality judgment means makes the judgment of abnormality to performthe abnormality stop when a signal from the same input terminal of thesecond input signal group consecutively changes a predetermined numberof times.
 13. The programmable controller described in claim 9, whereinthe signal processing device in the one system includes: serialdiagnosis pulse output means for serially outputting serial diagnosispulses for each input terminal to a processing device in another system;and pulse check means for inputting serial diagnosis pulses that areserially outputted for each input terminal from serial pulse outputmeans of the processing device in the another system and for making thejudgment of abnormality to execute the abnormality stop processing whenan input signal does not change in correspondence to the period of theserial diagnosis pulses.
 14. The programmable controller described inclaim 10, wherein the first signal processing device comprises: firstserial diagnosis pulse output means for serially outputting first serialdiagnosis pulses to the second check means for each input terminal; andfirst pulse check means for inputting thereinto second serial diagnosispulses that are serially outputted from the second signal processingdevice to the first check means for each input terminal and for makingthe judgment of abnormality to execute the abnormality stop processingwhen a first input signal does not change in correspondence to theperiod of the second serial diagnosis pulses, and wherein the secondsignal processing device comprises: second serial diagnosis pulse outputmeans for serially outputting the second serial diagnosis pulses to thefirst check means for each input terminal; and second pulse check meansfor inputting thereinto the first serial diagnosis pulses that areserially outputted from the first serial diagnosis pulse output means tothe second check means for each input terminal and for making thejudgment of abnormality to execute the abnormality stop processing whena second input signal does not change in correspondence to the period ofthe first serial diagnosis pulses.
 15. The programmable controllerdescribed in claim 9, wherein the check means comprises: a first photocoupler for inputting the input signal; and a second photo couplercomposed of a photo transistor connected in series to a light emittingdiode of the first photo coupler and a light emitting diode forgenerating an optical signal to the photo transistor of the second photocoupler upon receiving the diagnosis pulse.
 16. The programmablecontroller described in claim 10, wherein the first check meanscomprises: a first photo coupler for inputting the first input signal;and a second photo coupler composed of a photo transistor connected inseries to a light emitting diode of the first photo coupler and a lightemitting diode for generating an optical signal to the photo transistorof the second photo coupler upon receiving a second diagnosis pulse, andwherein the second check means comprises: a third photo coupler forinputting the second input signal; and a fourth photo coupler composedof a photo transistor connected in series to a light emitting diode ofthe third photo coupler and a light emitting diode for generating anoptical signal to the photo transistor of the fourth photo coupler uponreceiving a first diagnosis pulse.